Client-Confidential AI for Law Firms and CPA Practices

ABA Formal Opinion 512, IRC §7216, and the IRS's first Circular 230 AI guidance have moved AI from a policy choice to a professional-responsibility question. How local models map onto the confidentiality duty, and where they don't help.

Summary

For lawyers and tax practitioners, AI stopped being optional policy the moment the regulators started writing it down. The ABA's Formal Opinion 512, issued July 29, 2024, made clear that the ordinary duties of competence, confidentiality, communication, and supervision apply fully to generative AI. The IRS then issued its first guidance on AI in federal tax practice — Office of Professional Responsibility Alert 2026-19 — and IRC §7216 already requires a client's signed consent before tax return information leaves the country. The practical upshot: a cloud chatbot that trains on or transmits client data sits in tension with duties you can't contract away, while a model running on the firm's own hardware satisfies the confidentiality duty the same way a locked file cabinet does. This post lays out which rules bite, what a local model actually fixes, and — just as important — what it does not fix.

ABA Formal Opinion 512: the duties, made explicit

The ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, "Generative Artificial Intelligence Tools" (mirror copy), on July 29, 2024. It is worth reading in full because it refuses to invent new rules and instead maps existing Model Rules onto AI use. The duties it walks through:

• Competence (Rule 1.1). A lawyer using AI must understand the benefits and risks of the tool to the level needed to use it responsibly, or consult someone who does.
• Confidentiality (Rule 1.6). Information relating to the representation must be protected — which bears directly on whether client data may go into a tool that retains, trains on, or transmits it.
• Communication (Rule 1.4). Clients may need to be informed about how AI is being used in their matter, depending on the circumstances.
• Supervision (Rules 5.1 and 5.3). Partners and managers are responsible for the AI conduct of subordinate lawyers and nonlawyer staff, exactly as if the staff had used a fax machine carelessly.
• Meritorious claims and candor (Rules 3.1 and 3.3). AI output must be verified before it is asserted or filed; a hallucinated citation is the lawyer's error, not the model's.
• Fees (Rule 1.5). Charging for AI-assisted work must still be a reasonable fee for services actually rendered.

The opinion's central move is to treat AI as just another tool the lawyer is professionally responsible for. That is reassuring in one direction and uncomfortable in the other: it means there is no special AI exemption, and no way to blame the software.

Confidentiality is the hard one

Of the six duties, confidentiality is the one that actually constrains which AI you can use, not just how. Rule 1.6 and its state equivalents protect "information relating to the representation of a client" regardless of source. The question a firm has to answer about any AI tool is: where does that information go, who can see it, and is it retained or used to train a model?

A consumer chatbot whose terms of service allow the provider to retain and train on inputs cannot receive client-confidential information, because the lawyer cannot make reasonable efforts to prevent disclosure. Even where a vendor offers an enterprise tier with no-training commitments, the lawyer is still relying on a third party's written promise to protect the very thing Rule 1.6 says the lawyer is responsible for protecting. That does not make cloud AI categorically forbidden — Opinion 512 explicitly contemplates it — but it makes the confidentiality analysis real and case-specific, and it is the reason firms keep asking for a version that never leaves the office.

The tax side: §7216 consent and Circular 230

Tax practitioners have their own, separate statutory layer. Under IRC §7216 and its regulations, a return preparer may not disclose or use tax return information for purposes other than preparing the return without the taxpayer's written consent. Two things matter for AI:

• Offshore disclosure. A preparer must obtain the client's signed consent before disclosing tax return information to a preparer located outside the United States. If the client declines, the return information simply cannot go offshore. A cloud model hosted in another country is, functionally, an offshore disclosure.
• Consent form requirements. The consent must be specific, must be obtained before the disclosure, and must not be conditioned on the client receiving services. You cannot bury "we'll send your data to an AI vendor" in an engagement letter as a condition of doing the work.

On top of the statute, the IRS Office of Professional Responsibility issued its first formal guidance on AI in tax practice on June 24, 2026 — Alert 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice." Its headline requirement, widely summarized across the tax press, is that Circular 230 applies in full to AI: a practitioner must independently verify every AI-generated fact, citation, and conclusion before it reaches a client or the IRS. The practitioner is accountable for the output regardless of where it came from. There was also a pointed exchange about whether using AI should lower the fee — a reminder that the fees question from Opinion 512 shows up in the tax world too.

How a local model maps onto these duties

Running the model on the firm's own hardware does something specific: it turns the confidentiality question from "do we trust this vendor's terms" into "do we trust our own server room" — which is a duty the firm was already satisfying before AI existed. No client information leaves the office, nothing is retained by a third party, nothing is used to train someone else's model. The confidentiality analysis (Rule 1.6) and the §7216 offshore-consent question both collapse in the firm's favor, because there is no disclosure to anyone.

That is a genuine, categorical advantage, and it is the reason law firms and CPA practices are the most common kind of client for this kind of work — where the engagement starts with an on-site audit that maps the rules onto your actual systems. A local model with audit logging also gives the firm a record of what was run against which data — useful if the supervision or candor duties are ever examined.

What a local model does not fix

Just as important is what it leaves untouched, and being honest here is the difference between a real deployment and a liability:

Verification is still yours. The IRS guidance and Opinion 512 both make clear the output is the practitioner's responsibility. A local model hallucinates citations and math just like a cloud one does. Nothing about on-prem removes the duty to check.

Competence is still yours. Owning the hardware does not confer understanding. Someone at the firm still has to know what the tool can and cannot do well enough to supervise its use.

Privilege is not a feature of the model. Whether work product or privileged communications remain protected depends on how the tool is used and disclosed, not on where the GPU sits.

Security is now your job, not the vendor's. When the data is in the cloud, a vendor's SOC 2 report is someone else's problem to maintain. When it is in your server closet, patch management, access control, backups, and physical security are yours — and sizing the box is its own decision, which the RAM calculator handles. A local model trades the BAA/terms problem for an operations problem.

We cover exactly this trade in the setup process and flag the verification obligation in every scoping conversation, because it is the one clients most often assume the software handles for them.

The practical test for a firm

Before buying anything, a firm can run a three-question test on each proposed AI use:

1. Does client information leave the firm? If yes, is there a basis under Rule 1.6 (and §7216 for tax work) — consent, an exception, or a no-training/no-retention agreement? Get it in writing.
2. Who verifies the output? Name the human and the step. If the answer is "nobody," the use is not compliant at any price.
3. Who is accountable when it's wrong? If the answer is "the vendor," stop. It is the practitioner, always.

A local model makes question 1 easy and does nothing for questions 2 and 3 — which is a fair and useful summary of where on-prem AI actually helps a professional firm. If the answer to question 1 is "yes, and that worries us," the next step is a scoping conversation rather than a purchase.

Key takeaways

1. The regulators have written it down. ABA Formal Opinion 512 (July 29, 2024) applies competence, confidentiality, communication, supervision, candor, and fees to AI; the IRS's Alert 2026-19 does the same for Circular 230.
2. Confidentiality is the binding constraint. Rule 1.6 is the duty that decides which AI you can use, because it turns on where client information goes.
3. §7216 requires signed consent before offshore disclosure. Tax return information cannot leave the country without it, and the consent cannot be a condition of service.
4. The output is yours to verify. Both the ABA and the IRS are unambiguous that a hallucination is the practitioner's error, not the model's.
5. Local models fix the disclosure half. No third party, no retention, no training on client data — the confidentiality and §7216 questions collapse. Verification and competence remain yours.
6. It trades a vendor-trust problem for an operations problem. On-prem means you own patch management, access control, backups, and physical security, not the vendor.

Sources

• American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, "Generative Artificial Intelligence Tools" (July 29, 2024): https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf (mirror copy: https://www.lawnext.com/wp-content/uploads/2024/07/aba-formal-opinion-512.pdf)
• IRS — IRC §7216 and regulations (tax return information disclosure/use consent): https://www.irs.gov/tax-professionals/section-7216-information-center
• IRS Office of Professional Responsibility — Alert 2026-19, "Introductory Guidelines for Responsible AI Use in Federal Tax Practice" (June 24, 2026): https://www.irs.gov/tax-professionals/office-of-professional-responsibility-and-circular-230

This is general information about professional-responsibility rules, not legal advice. Confirm any specific decision with ethics counsel or, for tax practice, with Circular 230 counsel.